Item Level Security Question

Question

Good Afternoon,

Seeking advice for setting security on a custom SP2013 list.

All users need to be able to create a new item in the list. Users should not see items created by others.

So far, I set secuiry as follows: The list has unique permissions, not inheritting from any parent. A group named "Everyone" have contribute rights

Under List Settings - Advanced - Item Level Security:

"Read access" is set to "Read items that were created by the user"

"Create and Edit access" is set to "Create items and edit items that were created by the user"

This almost achieves my requirements, with one limitation. Sometimes, a users secretary fills out a list item for their boss. In that case, the boss cannot see or edit the item in the future. Only the secretary can read and edit.

There is only 1 secretary, so I thought that I may be able to draft a how-to on changing the security of the item (stop inheritance) and add the boss with "Full Control" on the list item.

My assumption was the Full Control would over-ride the default item-level-security set on the list as mentioned above. I have found that is not the case. When we email a link to the item to the boss after granting him full control on the item, the link is bad for him in the email. We know the link is good because it works for us, so we know this is a permissions issues.

I tried changing "Create and Edit access" is set to "Create and edit all items" however the link still does not work for the boss.

The boss should not see list items created by others.

Any advice?

Thanks!

-Mike

Answer 1

Solution 1: Below is one solution for your problem by breaking the inheritance:

1. Keep the permission broken for the list.
2. Remove the Item level security.
3. Create a new column(person or group column) in the list lets say "Created For".Keep this column as optional.
4. Every time the secretary fills data for Boss , make her/him fill the boss's name in the Created For column.
5. Create a simple SharePoint designer workflow to break permission on the list item and assign read/edit permission to Created By and Created For users.

See this blog to break inheritance using designer workflow. Make sure you select SharePoint 2010 workflow while creating the workflow.

Solution 2: Breaking the inheritance is not very recommended approach as it could make the list access slower. So another approach could be to not break the inheritance but to hide users from others data by adding extra filters to the View.

1. Do no break the inheritance.
2. Remove the item level security.
3. Create a new column(person or group column) in the list lets say "Created For".Keep this column as optional.
4. Every time the secretary fills data for Boss , make her/him fill the boss's name in the Created For column.
5. Edit the All items view and the extra filters Created By= [Me] OR Created For= [Me].

Make sure users do not have the permission to edit the view and see others data.

Answer 2

Changing value of Created by field seems to do the trick. After changing this value the secretary will no longer see the item, but your boss will.

I was able change the value using PowerShell and following JavaScript:

var context = SP.ClientContext.get_current()
var web = context.get_web()
var list = web.get_lists().getByTitle('Test') //title of the list
var item = list.getItemById(1) //id of the list item to change
item.set_item('Author', '13') //id of your boss
item.update()
context.executeQueryAsync(null, alert)

I've written this code in browser console so it needs a little work.

I've also tried to change this value using REST. I was able to change other user fields, but not the Author.

If you need no-code solution, you may check if it's possible to change this field using workflow.